Summary of "Security Operations Center (SOC) VITA RFP Pre-Proposal teleconference 2025 09"

Summary of the Security Operations Center (SOC) VITA RFP Pre-Proposal Teleconference

This teleconference focused on the Request for Proposal (RFP) process for providing managed Security Operations Center (SOC) services to local government entities in Virginia, facilitated by VITA (Virginia Information Technologies Agency). The session aimed to clarify the RFP scope, submission requirements, evaluation criteria, and timelines for interested suppliers.

Main Financial Strategies, Market Analyses, and Business Trends

Funding Source & Market Need: The RFP is driven primarily by Virginia’s participation in the State and Local Cybersecurity Grant Program (SLCGP), which combines federal grants and state matching funds to improve cybersecurity for local governments, tribal governments, and public education institutions. This highlights a trend of increasing government investment in cybersecurity infrastructure at the local level.
Target Market: The contract targets local government entities, tribal organizations, and public education institutions, excluding executive branch agencies. This reflects a segmentation strategy focusing on decentralized government units that often lack robust cybersecurity capabilities.
Contract Structure & Procurement Strategy: Multiple awards are expected from this RFP, creating a statewide contract available for optional use by eligible entities. This approach encourages competition and flexibility in supplier selection, promoting cost-effectiveness and scalability.
Pricing Transparency: Suppliers must submit detailed, transparent pricing including cost breakdowns for SOC services, applications, training, and optional services. Pricing must remain valid for 240 days, and suppliers must account for state-imposed transaction fees and industrial funding adjustments.

Market and Technical Requirements

Service Scope: The supplier will provide a fully managed SOC service including 24/7/365 monitoring, incident detection, analysis, response, triage, containment, mitigation, and resolution. Services must integrate with diverse local government IT environments.
Technology Requirements: The SOC must utilize Security Incident Event Management (SIEM) tools capable of integration with client environments and support flexible, elastic, and cost-effective service delivery.
Compliance and Security Standards: Suppliers must complete a C-RAMP (Commonwealth Risk and Authorization Management Program) assessment and comply with Virginia’s statutory mandated terms and conditions, ensuring adherence to state cybersecurity standards.

Step-by-Step Proposal Preparation and Submission Methodology

Pre-Proposal Participation:
- One representative per firm must register via chat.
- Questions can be submitted during and after the teleconference, but responses will be provided later via a Q&A posted on the VITA procurement portal (EVA).
Review RFP Documents:
- Thoroughly review the RP instructions document, pricing schedule (Appendix C), requirements spreadsheet (Appendix G), and C-RAMP assessment form (Appendix F).
- Understand mandatory contract terms and conditions, including non-negotiable statutory clauses.
Proposal Content and Format:
- Follow the detailed proposal format outlined in the RFP instructions.
- Provide a redacted copy of the proposal for public records, excluding confidential pricing.
- Include all required documentation, responses to functional and technical requirements (with detailed explanations, not just yes/no), and completed C-RAMP form.
Pricing Submission:
- Use the provided pricing templates or submit a custom pricing sheet ensuring all required cost categories are addressed.
- Pricing must be transparent, detailed, and valid for 240 days.
- Account for applicable fees such as the Industrial Funding Adjustment (IFA) and EVA transaction fees.
Subcontracting and SWaM Participation:
- If applicable, include a subcontracting plan that supports Virginia’s SWaM (Small, Women, and Minority-owned) business initiative.
- Provide the DSBSD certificate number for SWaM business verification.
Submission Process:
- Submit proposals electronically via the EVA portal by January 31, 2025, at 4:00 PM.
- No late submissions will be accepted.
- Contact EVA customer support for technical submission issues, not VITA.
Post-Submission:
- VITA will evaluate proposals in Q1 2025.
- Contract awards expected between March and April 2025.
- Suppliers should monitor EVA for amendments, Q&A updates, and other communications.

Key Reminders and Best Practices

Do not wait until the last minute to submit proposals.
Carefully follow all instructions and include all required documents.
Provide detailed responses to requirements rather than simple yes/no answers.
Maintain proposal pricing validity and transparency.
Regularly check the EVA portal for updates, amendments, and Q&A postings.
Direct all questions post-conference to the single point of contact via email.

Presenters / Sources

Enterprise Sourcing Specialist at VITA (name not specified)
VITA (Virginia Information Technologies Agency) as the organizing body
References to Virginia Department of Emergency Management (VDEM) and Virginia Cybersecurity Planning Committee